# CCNCore::Provision::Application::syslog
# Copyright (C) 2006, 2007 Stephane Alnet
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 3
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
# 

#
# For more information: http://carrierclass.net/
#
use strict; use warnings;

package CCNCore::Provision::Application::syslog;
use base qw(CCNCore::Provision::Base);
use CCN::Text;
use CCNCore::Scripting;

sub run()
{
    my $self = shift;
    return if $self->p->force_manager;

    $self->PACKAGE('syslog-ng');
    $self->CHECKFOR('/etc/syslog-ng');
    
    $self->enable('syslog-ng');

    foreach('/etc/syslog-ng/syslog-ng.conf')
    {
        CAT $_, <<'CONFIG';
#
# Configuration file for syslog-ng under Debian
# Modified by Stephane Alnet for CarrierClass.net
#
# attempts at reproducing default syslog behavior

# the standard syslog levels are (in descending order of priority):
# emerg alert crit err warning notice info debug
# the aliases "error", "panic", and "warn" are deprecated
# the "none" priority found in the original syslogd configuration is
# only used in internal messages created by syslogd


######
# options

options {
    # disable the chained hostname format in logs
    # (default is enabled)
    chain_hostnames(0);

    # the time to wait before a died connection is re-established
    # (default is 60)
    time_reopen(10);

    # the time to wait before an idle destination file is closed
    # (default is 60)
    time_reap(360);

    # the number of lines buffered before written to file
    # you might want to increase this if your disk isn't catching with
    # all the log messages you get or if you want less disk activity
    # (say on a laptop)
    # (default is 0)
    #sync(0);

    # the number of lines fitting in the output queue
    log_fifo_size(2048);

    # enable or disable directory creation for destination files
    create_dirs(yes);

    # default owner, group, and permissions for log files
    # (defaults are 0, 0, 0600)
    #owner(root);
    group(adm);
    perm(0640);

    # default owner, group, and permissions for created directories
    # (defaults are 0, 0, 0700)
    #dir_owner(root);
    #dir_group(root);
    dir_perm(0755);

    # enable or disable DNS usage
    # syslog-ng blocks on DNS queries, so enabling DNS may lead to
    # a Denial of Service attack
    # (default is yes)
    use_dns(no);

    # maximum length of message in bytes
    # this is only limited by the program listening on the /dev/log Unix
    # socket, glibc can handle arbitrary length log messages, but -- for
    # example -- syslogd accepts only 1024 bytes
    # (default is 2048)
    #log_msg_size(2048);

    #Disable statistic log messages.
    stats_freq(0);
};


######
# sources

# all known message sources
source s_all {
    # message generated by Syslog-NG
    internal();
    # standard Linux log source (this is the default place for the syslog()
    # function to send logs to)
    unix-stream("/dev/log");
    # messages from the kernel
    file("/proc/kmsg" log_prefix("kernel: "));
    # use the following line if you want to receive remote UDP logging messages
    # (this is equivalent to the "-r" syslogd flag)
    # udp();
};


######
# destinations

# some standard log files
destination df_auth     { file("/var/log/auth.log"); };
destination df_syslog   { file("/var/log/syslog"); };
destination df_cron     { file("/var/log/cron.log"); };
destination df_daemon   { file("/var/log/daemon.log"); };
destination df_kern     { file("/var/log/kern.log"); };
destination df_lpr      { file("/var/log/lpr.log"); };
destination df_mail     { file("/var/log/mail.log"); };
destination df_user     { file("/var/log/user.log"); };
destination df_uucp     { file("/var/log/uucp.log"); };

# these files are meant for the mail system log files
# and provide re-usable destinations for {mail,cron,...}.info,
# {mail,cron,...}.notice, etc.
destination df_facility_dot_info    { file("/var/log/$FACILITY.info"); };
destination df_facility_dot_notice  { file("/var/log/$FACILITY.notice"); };
destination df_facility_dot_warn    { file("/var/log/$FACILITY.warn"); };
destination df_facility_dot_err     { file("/var/log/$FACILITY.err"); };
destination df_facility_dot_crit    { file("/var/log/$FACILITY.crit"); };

# these files are meant for the news system, and are kept separated
# because they should be owned by "news" instead of "root"
destination df_news_dot_notice  { file("/var/log/news/news.notice" owner("news")); };
destination df_news_dot_err     { file("/var/log/news/news.err" owner("news")); };
destination df_news_dot_crit    { file("/var/log/news/news.crit" owner("news")); };

# some more classical and useful files found in standard syslog configurations
destination df_debug    { file("/var/log/debug"); };
destination df_messages { file("/var/log/messages"); };

# pipes
# a console to view log messages under X
destination dp_xconsole { pipe("/dev/xconsole"); };

# consoles
# this will send messages to everyone logged in
destination du_all { usertty("*"); };

######
# filters

# all messages from the auth and authpriv facilities
filter f_auth { facility(auth, authpriv); };

# all messages except from the auth and authpriv facilities
filter f_syslog { not facility(auth, authpriv); };

# respectively: messages from the cron, daemon, kern, lpr, mail, news, user,
# and uucp facilities
filter f_cron   { facility(cron); };
filter f_daemon { facility(daemon); };
filter f_kern   { facility(kern); };
filter f_lpr    { facility(lpr); };
filter f_mail   { facility(mail); };
filter f_news   { facility(news); };
filter f_user   { facility(user); };
filter f_uucp   { facility(uucp); };

# some filters to select messages of priority greater or equal to info, warn,
# and err
# (equivalents of syslogd's *.info, *.warn, and *.err)
filter f_at_least_info      { level(info..emerg); };
filter f_at_least_notice    { level(notice..emerg); };
filter f_at_least_warn      { level(warn..emerg); };
filter f_at_least_err       { level(err..emerg); };
filter f_at_least_crit      { level(crit..emerg); };

# all messages of priority debug not coming from the auth, authpriv, news, and
# mail facilities
filter f_debug { level(debug) and not facility(auth, authpriv, news, mail); };

# all messages of info, notice, or warn priority not coming form the auth,
# authpriv, cron, daemon, mail, and news facilities
filter f_messages {
        level(info,notice,warn)
            and not facility(auth,authpriv,cron,daemon,mail,news);
};

# messages with priority emerg
filter f_emerg { level(emerg); };

# complex filter for messages usually sent to the xconsole
filter f_xconsole {
    facility(daemon,mail)
        or level(debug,info,notice,warn)
        or (facility(news)
                and level(crit,err,notice));
};


######
# logs
# order matters if you use "flags(final);" to mark the end of processing in a
# "log" statement

# these rules provide the same behavior as the commented original syslogd rules

# auth,authpriv.*                 /var/log/auth.log
log {
        source(s_all);
        filter(f_auth);
        destination(df_auth);
};

# *.*;auth,authpriv.none          -/var/log/syslog
log {
        source(s_all);
        filter(f_syslog);
        destination(df_syslog);
};

# kern.*                          -/var/log/kern.log
log {
        source(s_all);
        filter(f_kern);
        destination(df_kern);
};

# mail.*                          -/var/log/mail.log
log {
        source(s_all);
        filter(f_mail);
        destination(df_mail);
};

# user.*                          -/var/log/user.log
log {
        source(s_all);
        filter(f_user);
        destination(df_user);
};

# mail.warn                       -/var/log/mail.warn
log {
        source(s_all);
        filter(f_mail);
        filter(f_at_least_warn);
        destination(df_facility_dot_warn);
};

# mail.err                        /var/log/mail.err
log {
        source(s_all);
        filter(f_mail);
        filter(f_at_least_err);
        destination(df_facility_dot_err);
};

# *.emerg                         *
log {
        source(s_all);
        filter(f_emerg);
        destination(du_all);
};

CONFIG
        IF_CHANGED $_, '/etc/init.d/syslog-ng reload';
    }
}
1;